lsPass

lsPass — local, encrypted password manager GTK4 / gtkmm-4 · C++23 · CMake · SQLite · libsodium lsPass stores logins, secure notes and API keys in a local encrypted vault. No network, no cloud, no telemetry. Nothing secret is ever written to disk in plaintext. Build & test sudo apt install...

Security Bulletin: Multiple Vulnerabilities affect IBM License Metric Tool v9

Summary Multiple vulnerabilities have been addressed in components used by IBM License Metric Tool Vulnerability Details CVEID:CVE-2026-17508 DESCRIPTION: In Bouncy Castle for Java before 1.86, several password-based key derivation entry points ran the KDF with cost parameters taken from the...

[SECURITY] Fedora 45 Update: kdf-26.08.2-1.fc45

KDiskFree displays the available file devices hard drive partitions, floppy and CD/DVD drives, etc. along with information on their capacity, free space, type and mount point...

Security Bulletin: IBM BigMemory Max is affected by bcprov-jdk18on that could allow attackers to execute a denial of service by exhausting system resources

Summary IBM BigMemory Max utilizes bcprov-jdk18on for TLS/SSL connections, digital signature generation/verification, file/data encryption, secure key storage PKCS12, PKCS8, and supporting modern cryptographic standards. Vulnerability Details CVEID:CVE-2026-17508 DESCRIPTION: In Bouncy Castle for...

Security Bulletin: IBM SPSS Modeler is affected by vulnerabilities in Bouncy Castle for Java

Summary IBM SPSS Modeler is affected by vulnerabilities in Bouncy Castle for Java. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-17508 DESCRIPTION: In Bouncy Castle for Java before 1.86, several password-based key derivation entry points ran the KDF with...

Security Bulletin: Multiple vulnerabilities in IBM Tivoli Network Manager IP Edition

Summary Multiple vulnerabilities were addressed in IBM Tivoli Network Manager IP Edition 4.2.0.25 IF1 Vulnerability Details CVEID:CVE-2026-17508 DESCRIPTION: In Bouncy Castle for Java before 1.86, several password-based key derivation entry points ran the KDF with cost parameters taken from the...

SUSE CVE-2026-17508

In Bouncy Castle for Java before 1.86, several password-based key derivation entry points ran the KDF with cost parameters taken from the untrusted input being processed, without bounding them, so a small input could dictate an arbitrary amount of work before any password or integrity check could...

CVE-2026-17508

A flaw was found in Bouncy Castle. Several password-based key derivation functions KDF process cost parameters directly from untrusted input without enforcing upper bounds. An attacker can exploit this vulnerability by supplying crafted input containing excessively high cost parameters, forcing t...

CVE-2026-17508

In Bouncy Castle for Java before 1.86, several password-based key derivation entry points ran the KDF with cost parameters taken from the untrusted input being processed, without bounding them, so a small input could dictate an arbitrary amount of work before any password or integrity check could...

UBUNTU-CVE-2026-17508

In Bouncy Castle for Java before 1.86, several password-based key derivation entry points ran the KDF with cost parameters taken from the untrusted input being processed, without bounding them, so a small input could dictate an arbitrary amount of work before any password or integrity check could...

CVE-2026-17508 Password-based KDF cost parameters honoured unbounded from untrusted input across the remaining PBE entry points

In Bouncy Castle for Java before 1.86, several password-based key derivation entry points ran the KDF with cost parameters taken from the untrusted input being processed, without bounding them, so a small input could dictate an arbitrary amount of work before any password or integrity check could...

CVE-2026-17508

The Bouncy Castle for Java cryptographic library (versions before 1.86 , LTS before 2.73.13 , and FIPS before bcpkix-fips 1.0.13, 2.0.13, and 2.1.13) contains a vulnerability where password-based key derivation functions (KDFs) use unbounded cost parameters from untrusted input. Specifically, the...

CVE-2026-17508

In Bouncy Castle for Java before 1.86, several password-based key derivation entry points ran the KDF with cost parameters taken from the untrusted input being processed, without bounding them, so a small input could dictate an arbitrary amount of work before any password or integrity check could...

EUVD-2026-91236

In Bouncy Castle for Java before 1.86, several password-based key derivation entry points ran the KDF with cost parameters taken from the untrusted input being processed, without bounding them, so a small input could dictate an arbitrary amount of work before any password or integrity check could...

CVE-2026-17508 Password-based KDF cost parameters honoured unbounded from untrusted input across the remaining PBE entry points

In Bouncy Castle for Java before 1.86, several password-based key derivation entry points ran the KDF with cost parameters taken from the untrusted input being processed, without bounding them, so a small input could dictate an arbitrary amount of work before any password or integrity check could...

CVE-2026-17508 Password-based KDF cost parameters honoured unbounded from untrusted input across the remaining PBE entry points

In Bouncy Castle for Java before 1.86, several password-based key derivation entry points ran the KDF with cost parameters taken from the untrusted input being processed, without bounding them, so a small input could dictate an arbitrary amount of work before any password or integrity check could...

CVE-2026-16001 IesEngine stream-mode MAC forgery via length-dependent KDF split

Exposure of the message authentication key through the encryption keystream in the stream mode of IesEngine an IesEngine constructed without a block cipher in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote attacker who has observed one encrypted message with known plainte...

CVE-2026-16001 IesEngine stream-mode MAC forgery via length-dependent KDF split

Exposure of the message authentication key through the encryption keystream in the stream mode of IesEngine an IesEngine constructed without a block cipher in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote attacker who has observed one encrypted message with known plainte...

PT-2026-104128

Name of the Vulnerable Software and Affected Versions Bouncy Castle for Java versions prior to 1.86 Bouncy Castle for Java LTS versions prior to 2.73.13 Bouncy Castle for Java FIPS BC-FJA bcpkix-fips versions prior to 1.0.13 Bouncy Castle for Java FIPS BC-FJA bcpkix-fips versions prior to 2.0.13...

Improper Verification of Cryptographic Signature

Overview openssl-encrypt is an A package for secure file encryption and decryption based on modern ciphers using heavy-compute-load chaining of hashing and KDF to generate strong encryption password based on users provided password to ensure secure encryption of files Affected versions of this...